1. Tony Chebli

2. The Bottom Line
“INFORMATION is an asset which, like other important business assets, has value to an organization and consequently needs to be suitably PROTECTED”
“…...Whatever form the information takes, or means by which it is shared or stored, it should always be appropriately protected”
ISO

3. Our Objectives

4. The Ugly Truth
“The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn’t stake my life on it.”
Gene Spafford- Director, Computer operations, audit and Security Technology
(COAST)-Purdue University

5. Absence of Framework or Standards
No clear direction for Management intentions toward information security
Lack of Management support
Lack of staff focus
Ad-hoc protection
Under protection
Over protection
Undetermined of security level

6. Framework/Standards Advantages
Confidence
Competitive Edge
Enforced regulations
Gain new customers
Focused staff responsibilities
Survival
IMAGE
Profitability $

7. ISO 27001
ISO is a process to develop and implement an information security management system (ISMS)
ISO is the only auditing specification for information security management systems
ISO is a management tool…!
To manage problems with an: information security management system (ISMS)
The objective of the standard is to "provide requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System (ISMS)".

8. ISO 27001
100+ Controls- Annex A

9. PCI-DSS
The Payment Card Industry Data Security Standard (PCI-DSS) is a worldwide information security standard assembled by the Payment Card Industry Security Standards Council (PCI SSC). The standard was created to help organizations that process card payments prevent credit card fraud through increased controls around data and its exposure to compromise.

10. PCI-DSS Requirements
300+ Controls